! PermitANY — Palo Alto Site-to-Site IPSec VPN
! IKEv2 site-to-site IPSec VPN tunnel on Palo Alto PAN-OS. Generates IKE crypto profile, IPSec crypto profile, IKE gateway, IPSec tunnel, and tunnel interface.
! Generated: 2026-09-20
! These are EXAMPLE values. Replace with your actual config before deploying.
!
# Palo Alto IPSec VPN — PA-FW-01
#
# IKE Crypto Profile
set network ike crypto-profiles ike-crypto-profiles IKE-PROFILE-203.0.113.2 dh-group [group20]
set network ike crypto-profiles ike-crypto-profiles IKE-PROFILE-203.0.113.2 encryption [aes-256-cbc]
set network ike crypto-profiles ike-crypto-profiles IKE-PROFILE-203.0.113.2 hash [sha512]
set network ike crypto-profiles ike-crypto-profiles IKE-PROFILE-203.0.113.2 lifetime seconds 86400
#
# IPSec Crypto Profile
set network ike crypto-profiles ipsec-crypto-profiles IPSEC-PROFILE-203.0.113.2 esp encryption [aes-256-gcm]
{{#unless (eq esp_hash "none")}}
set network ike crypto-profiles ipsec-crypto-profiles IPSEC-PROFILE-203.0.113.2 esp authentication [sha512]
{{/unless}}
set network ike crypto-profiles ipsec-crypto-profiles IPSEC-PROFILE-203.0.113.2 dh-group group20
set network ike crypto-profiles ipsec-crypto-profiles IPSEC-PROFILE-203.0.113.2 lifetime seconds 3600
#
# IKE Gateway
set network ike gateway GW-203.0.113.2 authentication pre-shared-key key MyVPNKey123!
set network ike gateway GW-203.0.113.2 protocol ikev2 ike-crypto-profile IKE-PROFILE-203.0.113.2
set network ike gateway GW-203.0.113.2 protocol ikev2 dpd enable yes
set network ike gateway GW-203.0.113.2 local-address ip 203.0.113.1
set network ike gateway GW-203.0.113.2 peer-address ip 203.0.113.2
set network ike gateway GW-203.0.113.2 protocol-common nat-traversal enable yes
#
# Tunnel Interface
set network interface tunnel units tunnel.1
set  zone vpn-zone network layer3 tunnel.1
set network virtual-router default interface tunnel.1
#
# IPSec Tunnel
set network tunnel ipsec TUNNEL-203.0.113.2 auto-key ike-gateway GW-203.0.113.2
set network tunnel ipsec TUNNEL-203.0.113.2 auto-key ipsec-crypto-profile IPSEC-PROFILE-203.0.113.2
set network tunnel ipsec TUNNEL-203.0.113.2 tunnel-interface tunnel.1
set network tunnel ipsec TUNNEL-203.0.113.2 anti-replay yes
set network tunnel ipsec TUNNEL-203.0.113.2 copy-tos yes

set network tunnel ipsec TUNNEL-{{../peer_ip}} auto-key proxy-id proxy-1 local 192.168.1.0/24
set network tunnel ipsec TUNNEL-{{../peer_ip}} auto-key proxy-id proxy-1 remote 10.0.0.0/24
set network tunnel ipsec TUNNEL-{{../peer_ip}} auto-key proxy-id proxy-1 protocol any

#
commit